Vulnerability · Published Jul 30, 2026 · Assigned by WPScan
CVE-2026-14318GiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template Settings
Medium 6.8
In plain English
A medium-severity cross-site scripting in GiveWP from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)0.4%top 62.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
References
- https://wpscan.com/vulnerability/2957014f-542d-43fc-ad65-de236446eeeb/ exploit, vdb-entry, technical-description